Cloudflare CEO Matthew Prince warned that the network observed millions of exploit attempts following the public disclosure of a critical PHP vulnerability.
In a Thursday post on X, Prince said that in the 10 hours before the vulnerability was disclosed, the network saw thousands of exploit attempts, which have now reached “millions.”
Cloudflare is an internet infrastructure company that helps websites load faster and protects them from cyberattacks. According to the company, about one in five websites worldwide routes traffic through its network.
On Wednesday, the PHP Foundation acknowledged that a shortage of resources delayed a fix for a critical security flaw first identified in 2024 and released emergency patches for two critical vulnerabilities.
The vulnerability may allow attackers to spread malware or inject malicious scripts into websites around the world. PHP powers an estimated 69% of websites with a known server-side programming language, according to research service W3Techs.
The FBI’s Cyber Division warned in a Wednesday post on X that the two critical vulnerabilities may “allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks.” The division urged organizations to either adopt an immediate update or take their systems offline.
Multiple organizations and government agencies took websites offline Wednesday as a precautionary measure.
